Examples disclosed herein relate to symmetrically encrypting a master passphrase key. In one implementation, a computing system includes a machine-readable storage medium to store a symmetrically encrypted master passphrase key, an encrypted version of a first passphrase key associated with a second machine-readable storage medium encrypted using the master passphrase key, and an encrypted version of a second passphrase key associated with a third machine-readable storage medium encrypted using the passphrase key. A processing resource may symmetrically encrypt the master passphrase key using an encryption key derived from authentication information and/or decrypt the stored master passphrase key using a decryption key derived from the authentication information.
|
8. A method, comprising:
associating a first non-transitory machine-readable storage medium with a first passphrase key used to unlock the first non-transitory machine-readable storage medium;
associating a second non-transitory machine-readable storage medium with a second passphrase key used to unlock the second non-transitory machine-readable storage medium;
storing, by a third non-transitory machine-readable storage medium, a symmetrically encrypted master passphrase key, an encrypted version of the first passphrase key encrypted using the master passphrase key, and an encrypted version of the second passphrase key encrypted using the master passphrase key; and
at least one of:
symmetrically encrypting a master passphrase key using an encryption key derived from authentication information; and
decrypting the stored master passphrase key using a decryption key derived from the authentication information;
wherein the authentication information is associated with a first user and wherein the third non-transitory machine-readable storage medium further stores an encrypted version of the master passphrase key symmetrically encrypted using an encryption key derived from second authentication information associated with a second user.
1. A computing system, comprising:
a first non-transitory machine-readable storage medium associated with a first passphrase key used to unlock the first non-transitory machine-readable storage medium;
a second non-transitory machine-readable storage medium associated with a second passphrase key used to unlock the second non-transitory machine-readable storage medium;
a third non-transitory machine-readable storage medium to store:
a symmetrically encrypted master passphrase key;
an encrypted version of the first passphrase key encrypted using the master passphrase key;
an encrypted version of the second passphrase key encrypted using the master passphrase key; and
a processing resource to:
at least one of:
symmetrically encrypt the master passphrase key using an encryption key derived from authentication information; and
decrypt the stored master passphrase key using a decryption key derived from the authentication information;
wherein the authentication information is associated with a first user and wherein the third non-transitory machine-readable storage medium further stores an encrypted version of the master passphrase key symmetrically encrypted using an encryption key derived from second authentication information associated with a second user.
13. A computing system, comprising:
a first non-transitory machine-readable storage medium associated with a first passphrase key used to unlock the first non-transitory machine-readable storage medium;
a second non-transitory machine-readable storage medium associated with a second passphrase key used to unlock the second non-transitory machine-readable storage medium;
a third non-transitory machine-readable storage medium to store:
a symmetrically encrypted master passphrase key;
an encrypted version of the first passphrase key encrypted using the master passphrase key;
an encrypted version of the second passphrase key encrypted using the master passphrase key;
a processing resource to:
at least one of:
symmetrically encrypt the master passphrase key using an encryption key derived from authentication information; and
decrypt the stored master passphrase key using a decryption key derived from the authentication information; and
a fourth non-transitory machine-readable storage medium and wherein the fourth non-transitory machine-readable storage medium further stores:
an encrypted version of a second master passphrase key encrypted using a second encryption key derived from second authentication information; and
an encrypted version of a third passphrase key associated with the fourth non-transitory machine-readable storage medium encrypted using the second master passphrase key.
2. The computing system of
decrypt the encrypted version of the first passphrase using the decrypted master passphrase key; and
access the first non-transitory machine-readable storage device using the first passphrase.
3. The computing system of
an encrypted version of a second master passphrase key encrypted using a second encryption key derived from second authentication information; and
an encrypted version of a third passphrase key associated with the fourth non-transitory machine-readable storage medium encrypted using the second master passphrase key.
4. The computing system of
5. The computing system of
6. The computing system of
7. The method of
9. The method of
decrypting the encrypted version of the first passphrase using the decrypted master passphrase key; and
accessing the first non-transitory machine-readable storage device using the first passphrase.
10. The method of
11. The method of
12. The method of
14. The computing system of
15. The computing system of
|
|||||||||||||||||||||||
An electronic device may include multiple storage devices. For example, an electronic device may include multiple self-encrypting storage devices, such as self-encrypting non-volatile memory devices. The storage devices may be unlocked at boot time of the electronic device.
The drawings describe example embodiments. The following detailed description references the drawings, wherein:
In one implementation, a computing system includes multiple machine-readable storage mediums, such as self-encrypting storage devices, and individual passphrase keys for the machine-readable storage mediums are encrypted using a hierarchical encryption scheme with a symmetrically encrypted master passphrase key. The master passphrase key may be derived from authentication information, such as a user password, and the master passphrase key may be used to encrypt passphrase keys associated with machine-readable storage mediums.
Symmetrically encrypting a master passphrase key may allow authentication information to be used to derive encryption and decryption keys. For example, an encryption and decryption key for the master passphrase key may be derived based on user password or biometric information. The master passphrase key may be used to transparently unlock multiple machine-readable storage mediums associated with a device. For example, the master passphrase key may be used to decrypt encrypted passphrase keys associated with different machine-readable storage mediums, and the decrypted passphrase keys may be used to access the associated machine-readable storage mediums. The individual machine-readable storage mediums may be unlocked without the user remembering and entering multiple passwords.
A symmetrically encrypted master passphrase key may be advantageous when multiple users are associated with the same electronic device. For example, the master passphrase key may be symmetrically encrypted based on an encryption key derived from first authentication information associated with a first user, and the master passphrase key may be symmetrically encrypted based on an encryption key derived from second authentication information associated with a second user. The two versions associated with the different users may allow either user to have access to the master passphrase key for decrypting the machine-readable storage medium passphrase keys and unlocking the machine-readable storage mediums.
The processing resource 101 may be platform firmware (e.g., UEFI or BIOS firmware), a central processing unit (CPU), a semiconductor-based microprocessor, or any device suitable for retrieval and execution of instructions. As an alternative or in addition to fetching, decoding, and executing instructions, the processing resource 101 may include one or more integrated circuits (ICs) or other electronic circuits that comprise a plurality of electronic components for performing the functionality described below. The functionality described below may be performed by processing resources.
The machine-readable storage medium 106 and the machine-readable storage medium 107 may be any suitable storage device that may use authentication information to protect the storage device. For example, the machine-readable storage medium 106 and the machine-readable storage medium 107 may each have a passphrase key used to gain read and/or write access. The computing system 100 may have any suitable number of machine-readable storage mediums and may store content in different machine-readable storage mediums based on content type and/or user. The machine-readable storage mediums 106 and 107 may be any suitable type of storage devices, such as NV-DIMM, a HDD, a SDD, or flash memory card. The machine-readable storage mediums 106 and 107 may be self-encrypting storage devices.
The machine-readable storage medium 102 may be a storage medium accessible to the processing resource 101. For example, the machine-readable storage medium 102 may be a machine-readable non-transitory storage medium. The machine-readable storage medium 102 may store information related to unlocking the self-encrypting storage devices 106 and 107. The machine-readable storage medium 102 may be a storage associated with platform firmware. The machine-readable storage medium 102 may store instructions executable by a processor. In one implementation, the machine-readable storage medium 102 is associated with a remote key manager. For example, an apparatus including the processing resource 101 and machine-readable storage mediums 106 and 107 may communicate with a remote key manager via a network. The remote key manager may include the machine-readable storage medium 102 and may store encrypted key information related to multiple devices, such as multiple devices in an enterprise environment.
The machine-readable storage medium 102 may store symmetrically encrypted master passphrase key 103, encrypted passphrase key 104 for machine-readable storage medium 106, and encrypted passphrase key 105 machine-readable storage medium 107. The encrypted passphrase key 104 and the encrypted passphrase key 105 may be symmetrically encrypted using the master passphrase key 103. For example, access to the master passphrase key 103 may allow for the encrypted passphrase key 104 and the encrypted passphrase key 105 to be decrypted and used to access the associated machine-readable storage mediums.
In one implementation, the processing resource 101 receives authentication information and uses the authentication information to generate an encryption key that may be used to symmetrically encrypt the master passphrase key. The authentication information may be any suitable authentication information, such as a password or biometric information. In one implementation, the authentication information is the operating system password for the computing system 100. The master passphrase key may be used to encrypt symmetrically the passphrase keys for the machine-readable storage medium 106 and the passphrase key for the machine-readable storage medium 107.
The encrypted passphrase keys 104 and 105 may be stored in the machine-readable storage medium 102 for later decryption and use. The processing resource 101 may decrypt the symmetrically encrypted master passphrase key 102. The processing resource 101 may use the decrypted master passphrase key to decrypt the encrypted passphrase keys 104 and 105. The processing resource 101 may store the decrypted master passphrase key, decrypted passphrase key for machine-readable storage medium 106, and the decrypted passphrase key for machine-readable storage medium 107 in volatile memory such that the passphrase keys for the machine-readable storage mediums 106 and 107 may be used to access the machine-readable storage mediums. For example, the decrypted passphrase key for machine-readable storage medium 106 may be used to access the machine-readable storage medium 106 to read and/or write data. In one implementation, the same passphrase key is used for unlocking multiple machine-readable storage medium, such as where a first set of machine-readable storage mediums are associated with a first passphrase key and where a second set of machine-readable storage mediums are associated with a second passphrase key.
The processing resource 201 may be platform firmware, a central processing unit (CPU), a semiconductor-based microprocessor, or any device suitable for retrieval and execution of instructions. As an alternative or in addition to fetching, decoding, and executing instructions, the processing resource 201 may include one or more integrated circuits (ICs) or other electronic circuits that comprise a plurality of electronic components for performing the functionality described below. The functionality described below may be performed by multiple processing resources.
The machine-readable storage mediums 207 and 208 may be any suitable storage devices, such as self-encrypting non-volatile memory devices. The machine-readable storage medium 202 may be a storage medium accessible to the processing resource 201. For example, the machine-readable storage medium 202 may be a machine-readable non-transitory storage medium. The machine-readable storage medium 202 may store information related to accessing the machine-readable storage mediums 207 and 208. The machine-readable storage medium 202 may be included as part of platform firmware storage or may include instructions executable by a processor.
The machine-readable storage medium 202 includes a symmetrically encrypted master passphrase key 203 encrypted using first authentication information and symmetrically encrypted master passphrase key 204 encrypted using second authentication information. For example, the same master passphrase key may be encrypted using different authentication information to create two different versions that may be decrypted based on decryption keys derived from different authentication information. The machine-readable storage mediums 207 and 208 may each have an associated passphrase key symmetrically encrypted with the master passphrase key. For example, the machine-readable storage medium 202 may store encrypted passphrase key 205 for machine-readable storage medium 207 and encrypted passphrase key 206 for machine-readable storage medium 208. The encrypted passphrase key 205 and the encrypted passphrase key 206 may each be encrypted using the master passphrase key.
The processing resource 301 may be platform firmware, a central processing unit (CPU), a semiconductor-based microprocessor, or any other device suitable for retrieval and execution of instructions. As an alternative or in addition to fetching, decoding, and executing instructions, the processing resource 301 may include one or more integrated circuits (ICs) or other electronic circuits that comprise a plurality of electronic components for performing the functionality described below. The functionality described below may be performed by multiple processors.
The machine-readable storage mediums 308, 309, and 310 may be any suitable storage device, such as self-encrypting storage devices, such as self-encrypting non-volatile memory devices. The machine-readable storage mediums 308, 309, and 310 may be NV-DIMM, a HDD, a SDD, and/or a flash memory card.
The machine-readable storage medium 302 may be a storage medium accessible to the processing resource 301. For example, the machine-readable storage medium 302 may be a machine-readable non-transitory storage medium. The machine-readable storage medium 302 may be, for example, a non-volatile memory device. The machine-readable storage medium 302 may include symmetrically encrypted first master passphrase key 303 and symmetrically encrypted second master passphrase key 304. The symmetrically encrypted first master passphrase key 303 may be encrypted based on an encryption key derived from first authentication information, and the symmetrically encrypted second master passphrase key 304 may be encrypted based on an encryption key derived from second authentication information. For example, the first authentication information may be associated with a first user, and the second authentication information may be associated with a second user. The different symmetrically encrypted passphrase keys may be encrypted using different methods. For example, the symmetrically encrypted first master passphrase key 303 may be encrypted using a first method, and the symmetrically encrypted second master passphrase 304 may be encrypted using a second method. The machine-readable storage medium passphrase keys may be symmetrically encrypted with a master passphrase encrypted using authentication information associated with a particular user such that the same authentication information may be used to create a decryption key for decrypting passphrase keys for storage devices associated with the particular user.
In one implementation, the computing system 300 includes multiple machine-readable storage mediums where different authentication information is used to encrypt a master key associated with different sets of non-volatile memory devices, such as where different machine-readable storage mediums are associated with different users. For example, the machine-readable storage medium 302 may include encrypted passphrase key 305 for machine-readable storage medium 308 encrypted with the first master passphrase key, encrypted passphrase key 306 for machine-readable storage medium 309 encrypted with the first master passphrase key, and encrypted passphrase key 307 for machine-readable storage medium 310 encrypted with the second master passphrase key. The machine-readable storage mediums 308 and 309 may be associated with a first user, and machine-readable storage medium 310 may be associated with a second user.
Beginning at 400, a processing resource generates an encryption key based on authentication information. The processing resource may be, for example, platform firmware or a processor. The encryption key may be generated based on user authentication information, such as a password or biometric information. The encryption key may be derived using any suitable method. For example, the encryption key may be derived using a keyword derivation function, such as based on password hashing or PBKDF2. The encryption key may be generated by a device including multiple encrypted storage devices or may be generated by a remote device.
Continuing to 401, a processing resource symmetrically encrypts a master passphrase key using the encryption key. The master passphrase key may be any suitable encryption key. The master passphrase key may be associated with a particular device or may be generated to be associated with a particular user or set of users.
Continuing to 402, a processing resource stores the encrypted master passphrase key. The encrypted master passphrase key may be stored in any suitable device. In one implementation, the master passphrase key is stored in a non-volatile memory. The master passphrase key may be decrypted and the decrypted master passphrase key may be stored in volatile memory for use in decrypting other devices. In one implementation, the encrypted master passphrase key is transmitted to a remote key server for storage.
Continuing to 403, a processing resource symmetrically encrypts a first passphrase key associated with a first machine-readable storage medium using the master passphrase key. For example, an apparatus may include multiple self-encrypting storage devices such that each self-encrypting storage device has a different passphrase encryption used to access the particular storage device. A first machine-readable storage medium may have an associated first passphrase key that is used to access the device. The master passphrase key may be used to encrypt the first passphrase key in any suitable manner, such as using a symmetrical encryption method. The machine-readable storage device may be any suitable storage device, such as a non-volatile memory device.
Continuing to 404, a processing resource symmetrically encrypts a second passphrase key associated with a second machine-readable storage medium using the master passphrase key. For example, an apparatus may include the first and second machine-readable storage mediums. The self-encrypting storage devices may store different types of data and/or data associated with different users.
The apparatus may include any suitable number of machine-readable storage mediums. In one implementation, there are multiple master passphrase keys, such as where a first master passphrase key is used to encrypt passphrase keys associated with a first and second machine-readable storage medium, and a second master passphrase key is used to encrypt passphrase keys associated with a third and fourth machine-readable storage medium. The first master passphrase key may be symmetrically encrypted based on first authentication information, and the second master passphrase key may be symmetrically encrypted based on second authentication. The first authentication information may be associated with a first user, and the second authentication information may be associated with a second user.
In one implementation, the same master passphrase key may be encrypted and stored as multiple versions. For example, the master passphrase key may be symmetrically encrypted using an encryption key derived from first authentication information and stored for later use. The master passphrase key may be symmetrically encrypted using an encryption key derived from second authentication information and stored for later use. Both versions of the encrypted master passphrase key may be stored such that the associated user may unlock the version encrypted with the associated user information such that both users may have access to the machine-readable storage mediums with passphrase keys encrypted with the master passphrase key.
Continuing to 405, a processing resource stores the encrypted first passphrase key and the encrypted second passphrase key. For example, the encrypted first passphrase key and the encrypted second passphrase key may be stored in a non-volatile memory device. In one implementation, the stored encrypted master passphrase key, encrypted first passphrase key associated with a first machine-readable storage medium, and encrypted second passphrase key associated with a second machine-readable storage medium may be accessed for decryption and use.
Beginning at 500, a processing resource decrypt a stored symmetrically encrypted master passphrase key using a decryption key derived from authentication information. The processing resource may be, for example, platform firmware in an apparatus including multiple encrypted machine-readable storage mediums with different passphrase keys.
The encryption key may be derived in any suitable manner. The authentication information may be, for example, a user password, secret, and/or biometric information. The authentication information may be received in any suitable manner, such as from a user. The authentication information may be a password associated with a device including the machine-readable storage mediums. For example, the authentication may be an operating system password associated with a particular user. The authentication information may be associated with a particular user such that the master passphrase key may be decrypted for a particular user. In one implementation, there are multiple encrypted versions of the master passphrase key, where each version is encrypted based on authentication information associated with a different user. The version of the master passphrase key encrypted for the particular user may be decrypted using the authentication information associated with the particular user.
The master passphrase key may be stored in any suitable location, such as in a volatile storage associated with an apparatus including the machine-readable storage mediums. For example, for security reasons, the unencrypted version of the master passphrase key may not be stored in permanent media or transmitted to a remote server, and the unencrypted master passphrase key storage may be limited to volatile memory.
Continuing to 501, a processing resource uses the decrypted master passphrase key to decrypt a set of symmetrically encrypted machine-readable storage medium passphrase keys. For example, the machine-readable storage medium passphrase keys may be encrypted by the master passphrase key and stored. The processing resource may decrypt the stored machine-readable storage medium passphrase keys. The encrypted machine-readable storage medium passphrase keys may be stored in a non-volatile memory device. The processing resource may decrypt a set of passphrase keys, such as those encrypted with the same master passphrase key and associated with the same user or user set.
Continuing to 502, a processing resource stores the decrypted passphrase keys in volatile memory. For example, at boot time, platform firmware may decrypt the passphrase keys associated with the machine-readable storage medium stored in non-volatile memory and store the decrypted passphrase keys in volatile memory for access when data is requested to be read and/or written to a particular one of the machine-readable storage devices.
Continuing to 503, a processing resource uses at least one of the stored passphrase keys to access an associated machine-readable storage medium. The processing resource may use a second passphrase key stored in volatile memory to access a second machine-readable storage medium. The passphrase key may be used to access a machine-readable storage medium if read and/or write access is requested by an application. Using a symmetrically encrypted master passphrase key to hierarchically encrypt passphrase keys for machine-readable storage mediums may allow for a transparent solution for storage device protection.
Waldron, James R., Santos, Anellena, Perez, Taciano, Medaglia, Diego R., Ramos, Dirceu
| Patent | Priority | Assignee | Title |
| Patent | Priority | Assignee | Title |
| 6012145, | Nov 13 1993 | Calluna Technology Limited | Security system for hard disk drive |
| 9043610, | Jul 07 2008 | Hewlett-Packard Development Company, L.P.; HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | Systems and methods for data security |
| 9768952, | Sep 22 2015 | Seagate Technology LLC | Removable circuit for unlocking self-encrypting data storage devices |
| 20050027989, | |||
| 20050114686, | |||
| 20070088947, | |||
| 20070297608, | |||
| 20080155680, | |||
| 20090080662, | |||
| 20130055382, | |||
| 20140140508, | |||
| 20160085963, | |||
| 20170093563, | |||
| WO2018022091, |
| Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
| Jun 13 2017 | SANTOS, ANELLENA | HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046859 | /0268 | |
| Jun 13 2017 | MEDAGLIA, DIEGO R | HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046859 | /0268 | |
| Jun 13 2017 | PEREZ, TACIANO | HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046859 | /0268 | |
| Jun 13 2017 | RAMOS, DIRCEU | HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046859 | /0268 | |
| Jun 17 2017 | WALDRON, JAMES R | HEWLETT-PACKARD DEVELOPMENT COMPANY, L P | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 046859 | /0268 | |
| Jun 20 2017 | Hewlett-Packard Development Company, L.P. | (assignment on the face of the patent) | / |
| Date | Maintenance Fee Events |
| Aug 07 2018 | BIG: Entity status set to Undiscounted (note the period is included in the code). |
| Date | Maintenance Schedule |
| Mar 22 2025 | 4 years fee payment window open |
| Sep 22 2025 | 6 months grace period start (w surcharge) |
| Mar 22 2026 | patent expiry (for year 4) |
| Mar 22 2028 | 2 years to revive unintentionally abandoned end. (for year 4) |
| Mar 22 2029 | 8 years fee payment window open |
| Sep 22 2029 | 6 months grace period start (w surcharge) |
| Mar 22 2030 | patent expiry (for year 8) |
| Mar 22 2032 | 2 years to revive unintentionally abandoned end. (for year 8) |
| Mar 22 2033 | 12 years fee payment window open |
| Sep 22 2033 | 6 months grace period start (w surcharge) |
| Mar 22 2034 | patent expiry (for year 12) |
| Mar 22 2036 | 2 years to revive unintentionally abandoned end. (for year 12) |